EU AI Act in Hungary: Who Enforces It Under Act LXXV of 2025

Hungary is one of the EU Member States that has already legislated its EU AI Act enforcement — and the answer to "who enforces it" is not the one most people guess. It is not the media regulator, and it is not the data protection authority. Under Act LXXV of 2025, in force since 1 December 2025, the body performing the AI Act market-surveillance and single-point-of-contact role is a government minister — the minister responsible for enterprise development, currently the Minister for National Economy.

That makes Hungary a comparatively settled case in a region where many states missed the deadline. This guide explains the Hungarian implementing law, which authority does what, how the data protection regime sits alongside it, the corrected timeline after the Digital Omnibus, and what Hungarian businesses should do now.

---

A Regulation, Not a Directive — but Hungary Legislated Anyway

The EU AI Act, Regulation (EU) 2024/1689, applies directly in Hungary under Article 288 of the Treaty on the Functioning of the European Union. It entered into force on 1 August 2024, and its early obligations bind Hungarian companies regardless of national law: Article 5 prohibited practices and Article 4 AI literacy since 2 February 2025, and general-purpose AI (GPAI) obligations under Chapter V since 2 August 2025.

A Regulation does not need transposition. What Hungary still had to do — and has now done — is designate enforcement authorities, create domestic procedures, and confer powers. Hungary completed this through Act LXXV of 2025, "on the implementation of the European Union Regulation on Artificial Intelligence in Hungary", with operational detail in Government Decree 344/2025. The Act was promulgated on 31 October 2025; most of its provisions entered into force on 1 December 2025, with two provisions taking effect on 2 August 2026 to align with the Regulation's general-application date.

A point of timing worth being honest about: the Article 70 designation deadline was 2 August 2025, and Hungary's framework only came into force on 1 December 2025. Hungary therefore missed the EU deadline — but it has since completed the designation in law, which puts it ahead of states still drafting.

---

Who Enforces the EU AI Act in Hungary?

The Minister for National Economy: Market-Surveillance Authority and Single Point of Contact

Under Act LXXV of 2025 and Decree 344/2025, the minister responsible for enterprise development (currently the Minister for National Economy) performs the tasks of the AI market-surveillance authority and acts as Hungary's single point of contact for the EU AI Office. This is the central enforcement role — the body that conducts market surveillance of high-risk AI systems and represents Hungary in EU-level coordination.

The naming of a minister rather than a stand-alone agency is a deliberate machinery-of-government choice. Different sources render the title slightly differently — "Minister for National Economy", or the minister responsible for enterprise development within the Ministry of National Economy — but the substance is consistent: the enforcement authority is a government minister, not a regulator like NMHH or NAIH.

The National Accreditation Authority: Notifying Authority

The National Accreditation Authority (NAH) is designated as Hungary's notifying authority under Article 28 — the body responsible for assessing, designating, and monitoring the notified bodies that carry out third-party conformity assessment of certain high-risk AI systems. For financial-sector AI, market surveillance is assigned separately to the Hungarian National Bank under Article 74(6).

The Advisory AI Council — and Where NMHH and NAIH Actually Sit

Hungary established an advisory Artificial Intelligence Council. It issues guidelines and opinions but takes no enforcement decisions. This is where the bodies people often mistake for the enforcer actually appear — as delegates, not regulators. Bodies that may delegate members include the National Media and Infocommunications Authority (NMHH), the Hungarian National Bank, the Competition Authority, the data protection authority (NAIH), the Supervisory Authority for Regulatory Affairs, and the Digital Hungary Agency. The Council's chair is appointed by the Prime Minister.

So NMHH — Hungary's media and telecoms regulator and Digital Services Act coordinator — is not an AI Act market-surveillance authority. It sits on the advisory Council. Do not assume the media regulator inspects your AI system; it does not.

NAIH: The Data Protection Authority

Hungary's data protection authority is NAIH — the Nemzeti Adatvédelmi és Információszabadság Hatóság, the National Authority for Data Protection and Freedom of Information. NAIH is the GDPR supervisor in Hungary, and for AI systems that process personal data it is unavoidable — but, importantly, NAIH is not the AI Act market-surveillance authority. Its formal role under Act LXXV of 2025 is to delegate a member to the advisory Council. The AI Act enforcement role belongs to the Minister for National Economy.

The AI Office (Brussels): GPAI Stays at EU Level

General-purpose AI model providers are supervised not by any Hungarian authority but by the EU AI Office in Brussels, under Articles 53 and 55, with fines imposed by the Commission under Article 101. A Hungarian company that merely uses a general-purpose model is a deployer of the system it builds — not a GPAI provider answerable to the AI Office for the model.

---

A Word on Facial Recognition in Hungary

Hungary attracted attention in early 2025 by amending its law to allow police use of facial-recognition technology in petty-offence (infraction) procedures generally — an expansion of biometric surveillance that entered into force in April 2025. This is not an early national AI Act provision, and it is not a ban. Civil-society groups have argued that the expansion conflicts with the AI Act's Article 5 restriction on real-time remote biometric identification in public spaces. For a Hungarian business, the lesson is not the politics but the principle: Article 5's prohibitions are EU law, apply directly, and are the first thing to check against your own systems.

---

The Hungarian Enforcement Timeline (After the Digital Omnibus)

The high-risk dates carry a caveat. Under the Digital Omnibus, the European Parliament and Council reached political agreement on 6–7 May 2026 to defer stand-alone high-risk Annex III systems to 2 December 2027 and product-embedded high-risk AI to 2 August 2028. That deferral is now adopted — the European Parliament approved it on 16 June 2026 and the Council formally adopted it on 29 June 2026, with entry into force on Official Journal publication, expected before 2 August 2026. Stand-alone high-risk Annex III obligations now apply from 2 December 2027. The deferral is a set of fixed calendar dates — not contingent on harmonised standards.

---

Penalties: What Hungarian Companies Actually Face

The penalty framework is Article 99 of the Regulation, applied in Hungary through Act LXXV of 2025. The ceilings are EU-wide; Hungary's law supplies the domestic procedure, not different figures. There are three tiers, each "whichever is higher" of a fixed sum or a percentage of total worldwide annual turnover:

• €35,000,000 or 7% — for breaching the Article 5 prohibitions.
• €15,000,000 or 3% — for most other breaches: high-risk requirements (Articles 9–15), provider duties (Article 16), deployer duties (Article 26), and Article 50 transparency.
• €7,500,000 or 1% — for supplying incorrect, incomplete, or misleading information to a notified body or authority.

The third tier is 1%, not 1.5% — there is no 1.5% tier in the Regulation. For SMEs and start-ups, Article 99(6) caps the fine at the lower of the fixed amount or the percentage. A Hungarian company with €10 million turnover does not face a €15 million fine for a high-risk breach — 3% of €10 million is €300,000, and that is the ceiling.

GPAI-specific fines are separate: up to €15 million or 3%, imposed by the Commission under Article 101 on the model provider — not by the Minister for National Economy.

---

Worked Example: A Budapest Fintech Lender

Consider Hitelpont Zrt., a fictional Budapest fintech — about 90 employees, roughly €14 million annual turnover — that offers an AI credit-scoring engine to Hungarian consumer lenders.

Creditworthiness assessment of natural persons is an Annex III high-risk use case (access to essential private services). Because Hitelpont builds the scoring engine and places it on the market under its own name, it is a provider under Article 16: Article 9 risk management, Annex IV technical documentation, an Article 43 conformity assessment, Article 14 human oversight, and Article 49 registration. Deployers of a credit-scoring system also owe an Article 27 fundamental-rights impact assessment.

Who supervises Hitelpont? Two authorities, in their lanes. As an AI credit-scoring system, it falls under AI Act market surveillance — and because it is financial-sector AI, that surveillance is assigned to the Hungarian National Bank under Article 74(6), not the general ministerial authority. Because it processes personal data, NAIH also supervises it under the GDPR, and a GDPR Article 35 Data Protection Impact Assessment is required alongside the Article 27 assessment. Hitelpont's sensible move: build the AI Act documentation now against the 2 December 2027 high-risk date, and engage early with both the central bank's expectations and NAIH guidance. On €14 million turnover, its worst-case high-risk exposure is 3% — about €420,000 — far below the headline figure.

---

How Confir Helps Hungarian Companies

A Hungarian compliance team has a documentation-heavy obligation set: an AI inventory, Article 6 classification with the Annex III logic, role assignment, Article 9 risk records, the Annex IV technical file, the Article 27 assessment where it applies, and Article 72 post-market monitoring.

Confir is EU-hosted compliance software built for this work. Its classification engine is rule-based and deterministic — it encodes Articles 5 and 6 with Annex III logic as explicit rules, so the same intake always yields the same finding with a human-readable explanation of which rule fired. It generates the Annex IV technical-documentation pack and the Article 47 / Annex V Declaration of Conformity, and runs the Article 27 assessment. The structured review spans four areas: risk classification, data and technical robustness, transparency and human oversight, and governance and post-market monitoring.

---

What Hungarian Companies Should Do Now

Immediately: Audit for any Article 5 prohibited practice — enforceable since February 2025. If a system fits a prohibited category and no exemption applies, stop or restructure it.

Before 2 August 2026: Bring chatbots, voice assistants, and AI content tools into line with Article 50 transparency — users must be told when they are interacting with AI or with synthetic content.

Through 2026–2027: Build the AI inventory, classify systems under Article 6 with the Article 6(3) filter, assign provider or deployer roles, and begin high-risk documentation, planning against 2 December 2027, the now-adopted high-risk deadline.

Ongoing: Watch for the Minister for National Economy's first enforcement actions and the advisory AI Council's guidelines — they will signal which sectors and obligations are being prioritised. For financial-sector AI, track the Hungarian National Bank's expectations specifically.

---

Related guides

• Who enforces the EU AI Act
• EU AI Act fundamentals
• EU AI Act penalties explained
• Provider vs deployer obligations
• Compliance guide for small businesses
• The EU AI Act in Austria
• The EU AI Act in Romania